Hi there,
I have a logfile, which has only the time inside. The date of the log is available in the filename. By using two regex and a template step, I was able to construct the correct string with the template section, but the timestamp stage does not recognise the value, just says none.
pipeline_stages:
#Example line: 11:57:12.405|core/main.cpp|main|INFO|Hello ... I am the here
- regex:
expression: "(?P<date>\\d+)$"
source: filename
- regex:
expression: "^(?P<time>[^|]+)\\|(?P<process>[^|]+)\\|(?P<logger>[^|]+)\\|(?P<level>[^|]+)\\|(?P<message>.+)"
- template:
source: timestamp
template: "{{ .date }}-{{ .time }} "
- timestamp:
source: timestamp
format: "20060102-15:04:05.9"
location: "Europe/Budapest"
- labels:
process:
logger:
timestamp:
- drop:
source: message
expression: "^\\s*$"
- output:
source: message
+: 20240425
[inspect: regex stage]:
{stages.Entry}.Extracted["level"]:
+: INFO
{stages.Entry}.Extracted["logger"]:
+: handleDisconnect
{stages.Entry}.Extracted["message"]:
+: Closing connection due to remote host disconnect request
{stages.Entry}.Extracted["process"]:
+: Thread#10
{stages.Entry}.Extracted["time"]:
+: 07:26:45.895
[inspect: template stage]:
{stages.Entry}.Extracted["timestamp"]:
+: 20240425-07:26:45.895
[inspect: timestamp stage]: none
[inspect: labels stage]:
{stages.Entry}.Entry.Labels:
-: {filename="/home/log/srvd.20240425" }
+: {filename="/home/log/srvd.20240425", logger="handleDisconnect", process="Thread#10", timestamp="20240425-07:26:45.895 "}
[inspect: output stage]:
{stages.Entry}.Entry.Entry.Line:
-: 07:26:45.895|Thread#10|handleDisconnect|INFO|Closing connection due to remote host disconnect request
+: Closing connection due to remote host disconnect request
level=info ts=2024-04-25T12:07:50.544364919Z caller=filetargetmanager.go:372 msg="Adding target" key="srvd.20240425:{ }"
Is this use-case not supported or did I something incorrectly?
